You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@activemq.apache.org by "ASF GitHub Bot (JIRA)" <ji...@apache.org> on 2014/05/02 04:18:15 UTC
[jira] [Commented] (AMQ-5160) Wildcard subscriptions bypass
Authentication / Authorization
[ https://issues.apache.org/jira/browse/AMQ-5160?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13987276#comment-13987276 ]
ASF GitHub Bot commented on AMQ-5160:
-------------------------------------
GitHub user dhirajsb opened a pull request:
https://github.com/apache/activemq/pull/21
Fix for AMQ-5160, add support for wildcard destination authorization
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/dhirajsb/activemq trunk
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/activemq/pull/21.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #21
----
commit 071c2d30ba5b497a66937c724605d18d04a7e516
Author: Dhiraj Bokde <db...@redhat.com>
Date: 2014-05-01T18:21:50Z
Initial fix for AMQ-5160 to support subscription authorization for destination filters
commit 2b6758c822a90ea6f78501c86b397e0d6550fb56
Author: Hadrian Zbarcea <ha...@apache.org>
Date: 2014-05-01T19:25:31Z
Temporarily disable failing test
commit 343c90415aca46f450ed493219facf6812a6dad9
Author: Dhiraj Bokde <db...@redhat.com>
Date: 2014-05-02T02:13:01Z
Fixed AMQ-5160, allowed wildcard subscriptions for future destinations, added tests for wildcard authorization, fixed consumer and producer AdvisoryTopic names for composite destinations by replacing ',' with '‚'
----
> Wildcard subscriptions bypass Authentication / Authorization
> ------------------------------------------------------------
>
> Key: AMQ-5160
> URL: https://issues.apache.org/jira/browse/AMQ-5160
> Project: ActiveMQ
> Issue Type: Bug
> Components: MQTT
> Affects Versions: 5.9.1
> Reporter: Surf
> Priority: Critical
> Labels: authentication, authorization, mqtt, security
> Attachments: activemq.xml, groups.properties, login.config, users.properties
>
>
> I am using MQTT on AMQ 5.9.1
> After latest MQTT hardening from [~dhirajsb] , there is an issue of MQTT retained messages.
> Simple case:
> Set Authentication / Authorization for two different TOPICS.
> Send retained message to one topic.
> Try to subscribe "#" with other second user.
> It will show retained messages published by TOPIC 1.
> here i have attached test configurations.
--
This message was sent by Atlassian JIRA
(v6.2#6252)